Your SOC Doesn't Need More Alerts—It Needs A Brain

Forbes

08-05-2025

Padraic O'Reilly is the Founder at CyberSaint, transforming cyber risk management with AI, automation, and actionable insights.
getty
The phrase "alert fatigue" has become a mainstay in cybersecurity conversations. However, behind the flood of findings, alerts, vulnerabilities and compliance gaps lies a deeper problem: the security context crisis. Security teams aren't just drowning in volume; they're operating without a clear sense of what matters most and why.
As expected, the cybersecurity landscape is in constant flux—both inside and outside your organization. Every day, new vulnerabilities are discovered, common vulnerabilities and exposures (CVEs) are published, threat actor tactics, techniques and procedures (TTPs) evolve and active exploit campaigns emerge. Meanwhile, internally, asset inventories shift, misconfigurations pop up and controls degrade.
Each of these changes can introduce new risk, but rarely are they evaluated together. Correlating this evolving external threat landscape with an equally dynamic internal environment is no small feat, and without the right context, it's nearly impossible to prioritize next steps effectively.
Security operations centers (SOCs) are overwhelmed. According to a 2023 Cybereason report, 16% of surveyed SOC professionals manage only 50% to 59% of their weekly alert volume—meaning nearly half of incoming alerts go unactioned. This is not a resource issue; it's a signal-to-noise issue.
This results in analysts spending more time triaging than reducing risk and security leaders struggling to extract meaning from the chaos.
The costs of this crisis are already playing out in SEC filings and earnings reports.
In January 2025, ahead of the World Economic Forum's annual meeting, global leaders warned of not just isolated attacks but a convergence of geopolitical tension, AI-powered threats and increasingly fragile digital infrastructure. CISOs and heads of state alike flagged the growing risk of large-scale systemic cyber events, where one compromised system could trigger cascading failures across sectors.
Despite this clear and present danger, many organizations still manage cyber risk in silos with disconnected tools and manual processes that can't keep pace. The threats are evolving faster than our ability to see them—let alone act.
Regulators are also increasing the pressure. The SEC has begun cracking down on companies for downplaying the scope or impact of cyber incidents.
These datapoints are signs of a system under strain, where the inability to identify and act on meaningful threats before they materialize leads to costly impacts.
The future of cybersecurity isn't about shrinking the number of alerts but about surfacing the right ones. This means providing context so security teams can address the highest priority findings first.
Security teams today are forced to treat every finding like a potential crisis because they lack the necessary context to know which issues are critical. Maybe it is, maybe it isn't?
Every alert is potentially critical because there isn't a reliable way to correlate internal cyber risk posture data (controls, assets, configurations, etc.) with external threat intelligence. Teams are stuck reacting to noise instead of acting on risk. This is where AI can help—not by replacing teams but by augmenting them with clarity and prioritization.
AI's role in security isn't to replace human analysts. It's to amplify their ability to prioritize by analyzing massive volumes of security-relevant data in real time and making connections that would take humans days or weeks to uncover. AI can identify patterns, anomalies and correlations that are invisible to the naked eye. For companies I've personally worked with, it can flag the three alerts out of 3,000 that actually point to a business-critical issue based on how likely and impactful the risk is—and it can do so continuously, learning and adapting to evolving threats and environments.
The shift isn't just toward automation; it's toward intelligent, contextual decision-support.
However, AI is only as powerful as the data it's trained on. In cybersecurity, that means pulling together everything—from asset configurations to TTPs to missing controls—and understanding how it all interacts.
The power of AI lies in its ability to connect these dots. Not just to reduce alert volume but to prioritize what matters based on business impact. Is this vulnerability on an internet-facing, revenue-generating asset? Is it being actively exploited in the wild? Do we have controls in place to mitigate it, or do we need to escalate? That's the kind of insight that prevents breaches, and that's what's missing today.
To bring meaning to chaos, organizations must ingest and correlate data such as vulnerabilities (system-specific exposures), common weakness enumerations (code-level flaws and design weaknesses), CVEs (known public vulnerabilities), TTPs (adversary behavior patterns such as MITRE ATT&CK), threat intelligence feeds (emerging IOCs and APT campaigns), assets (business-critical systems, endpoints, cloud workloads, etc.), control gaps (deviations from expected security posture), risks (aggregated threat likelihoods and impacts), compliance frameworks (requirements from NIST CSF, ISO 27001, etc.) and business context (which systems support revenue, operations or customer experience).
As cyber threats grow more dynamic and the internal environment shifts daily, CISOs are under pressure to lead with precision. However, precision requires clarity. Before meaningful automation or response can happen, CISOs must ask the right questions that expose where context is missing.
Here are a few to start with:
• Are we treating many of these alerts equally because we don't trust our prioritization logic?
• Do we understand our control environment and, importantly, holistic cyber risk posture well enough to know where we're most vulnerable? This means taking into account all relevant datapoints.
• Can we correlate our internal control data with active threat intelligence in real time? If not, why? How can we make this a strategic priority?
If the answer is "not yet," it's time to rethink the way your security program operates.
The next evolution of cyber risk management is powered by real-time data, automation and AI, and leaders (whether technical or business-side) can't make this shift soon enough. The tools are finally available if you look for them.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?